aws-cdk-lib 2.207.0__py3-none-any.whl → 2.209.0__py3-none-any.whl

aws_cdk/aws_elasticloadbalancingv2/__init__.py

@@ -1813,28 +1813,40 @@ class ApplicationListenerRule(
 ):
     '''Define a new listener rule.
 
-    :exampleMetadata: fixture=_generated
+    :exampleMetadata: infused
 
     Example::
 
-        # The code below shows an example of how to instantiate this type.
-        # The values are placeholders you should change.
-        from aws_cdk import aws_elasticloadbalancingv2 as elbv2
+        import aws_cdk.aws_lambda as lambda_
         
-        # application_listener: elbv2.ApplicationListener
-        # application_target_group: elbv2.ApplicationTargetGroup
-        # listener_action: elbv2.ListenerAction
-        # listener_condition: elbv2.ListenerCondition
+        # cluster: ecs.Cluster
+        # task_definition: ecs.TaskDefinition
+        # lambda_hook: lambda.Function
+        # blue_target_group: elbv2.ApplicationTargetGroup
+        # green_target_group: elbv2.ApplicationTargetGroup
+        # prod_listener_rule: elbv2.ApplicationListenerRule
         
-        application_listener_rule = elbv2.ApplicationListenerRule(self, "MyApplicationListenerRule",
-            listener=application_listener,
-            priority=123,
         
-            # the properties below are optional
-            action=listener_action,
-            conditions=[listener_condition],
-            target_groups=[application_target_group]
+        service = ecs.FargateService(self, "Service",
+            cluster=cluster,
+            task_definition=task_definition,
+            deployment_strategy=ecs.DeploymentStrategy.BLUE_GREEN
         )
+        
+        service.add_lifecycle_hook(ecs.DeploymentLifecycleLambdaTarget(lambda_hook, "PreScaleHook",
+            lifecycle_stages=[ecs.DeploymentLifecycleStage.PRE_SCALE_UP]
+        ))
+        
+        target = service.load_balancer_target(ecs.LoadBalancerTargetOptions(
+            container_name="nginx",
+            container_port=80,
+            protocol=ecs.Protocol.TCP
+        ), ecs.AlternateTarget("AlternateTarget",
+            alternate_target_group=green_target_group,
+            production_listener=ecs.ListenerRuleConfiguration.application_listener_rule(prod_listener_rule)
+        ))
+        
+        target.attach_to_application_target_group(blue_target_group)
     '''
 
     def __init__(

aws_cdk/aws_events/__init__.py

@@ -4013,6 +4013,10 @@ class CfnEventBus(
             description="description",
             event_source_name="eventSourceName",
             kms_key_identifier="kmsKeyIdentifier",
+            log_config=events.CfnEventBus.LogConfigProperty(
+                include_detail="includeDetail",
+                level="level"
+            ),
             policy=policy,
             tags=[CfnTag(
                 key="key",
@@ -4031,6 +4035,7 @@ class CfnEventBus(
         description: typing.Optional[builtins.str] = None,
         event_source_name: typing.Optional[builtins.str] = None,
         kms_key_identifier: typing.Optional[builtins.str] = None,
+        log_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventBus.LogConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         policy: typing.Any = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -4042,6 +4047,7 @@ class CfnEventBus(
         :param description: The event bus description.
         :param event_source_name: If you are creating a partner event bus, this specifies the partner event source that the new event bus will be matched with.
         :param kms_key_identifier: The identifier of the AWS KMS customer managed key for EventBridge to use, if you choose to use a customer managed key to encrypt events on this event bus. The identifier can be the key Amazon Resource Name (ARN), KeyId, key alias, or key alias ARN. If you do not specify a customer managed key identifier, EventBridge uses an AWS owned key to encrypt events on the event bus. For more information, see `Identify and view keys <https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html>`_ in the *AWS Key Management Service Developer Guide* . .. epigraph:: Schema discovery is not supported for event buses encrypted using a customer managed key. EventBridge returns an error if: - You call ``[CreateDiscoverer](https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers.html#CreateDiscoverer)`` on an event bus set to use a customer managed key for encryption. - You call ``[UpdatedEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdatedEventBus.html)`` to set a customer managed key on an event bus with schema discovery enabled. To enable schema discovery on an event bus, choose to use an AWS owned key . For more information, see `Encrypting events <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption-event-bus-cmkey.html>`_ in the *Amazon EventBridge User Guide* . > If you have specified that EventBridge use a customer managed key for encrypting the source event bus, we strongly recommend you also specify a customer managed key for any archives for the event bus as well. For more information, see `Encrypting archives <https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-archives.html>`_ in the *Amazon EventBridge User Guide* .
+        :param log_config: The logging configuration settings for the event bus. For more information, see `Configuring logs for event buses <https://docs.aws.amazon.com/eb-event-bus-logs.html>`_ in the *EventBridge User Guide* .
         :param policy: The permissions policy of the event bus, describing which other AWS accounts can write events to this event bus.
         :param tags: Tags to associate with the event bus.
         '''
@@ -4055,6 +4061,7 @@ class CfnEventBus(
             description=description,
             event_source_name=event_source_name,
             kms_key_identifier=kms_key_identifier,
+            log_config=log_config,
             policy=policy,
             tags=tags,
         )
@@ -4198,6 +4205,24 @@ class CfnEventBus(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "kmsKeyIdentifier", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="logConfig")
+    def log_config(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventBus.LogConfigProperty"]]:
+        '''The logging configuration settings for the event bus.'''
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventBus.LogConfigProperty"]], jsii.get(self, "logConfig"))
+
+    @log_config.setter
+    def log_config(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventBus.LogConfigProperty"]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__51db51bf8f1ebc8d9c19cdf02644ddeaaef6bd2b5c86607383cd85b5fa2030c1)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "logConfig", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="policy")
     def policy(self) -> typing.Any:
@@ -4277,6 +4302,84 @@ class CfnEventBus(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_events.CfnEventBus.LogConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"include_detail": "includeDetail", "level": "level"},
+    )
+    class LogConfigProperty:
+        def __init__(
+            self,
+            *,
+            include_detail: typing.Optional[builtins.str] = None,
+            level: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''The logging configuration settings for the event bus.
+
+            For more information, see `Configuring logs for event buses <https://docs.aws.amazon.com/eb-event-bus-logs.html>`_ in the *EventBridge User Guide* .
+
+            :param include_detail: Whether EventBridge include detailed event information in the records it generates. Detailed data can be useful for troubleshooting and debugging. This information includes details of the event itself, as well as target details. For more information, see `Including detail data in event bus logs <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html#eb-event-logs-data>`_ in the *EventBridge User Guide* .
+            :param level: The level of logging detail to include. This applies to all log destinations for the event bus. For more information, see `Specifying event bus log level <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html#eb-event-bus-logs-level>`_ in the *EventBridge User Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-eventbus-logconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_events as events
+                
+                log_config_property = events.CfnEventBus.LogConfigProperty(
+                    include_detail="includeDetail",
+                    level="level"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__325c97a9fc2ec199dfb4fb51645bc16dde3cf1f257d1bcf5c86f7cd3a0b2d77c)
+                check_type(argname="argument include_detail", value=include_detail, expected_type=type_hints["include_detail"])
+                check_type(argname="argument level", value=level, expected_type=type_hints["level"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if include_detail is not None:
+                self._values["include_detail"] = include_detail
+            if level is not None:
+                self._values["level"] = level
+
+        @builtins.property
+        def include_detail(self) -> typing.Optional[builtins.str]:
+            '''Whether EventBridge include detailed event information in the records it generates.
+
+            Detailed data can be useful for troubleshooting and debugging. This information includes details of the event itself, as well as target details.
+
+            For more information, see `Including detail data in event bus logs <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html#eb-event-logs-data>`_ in the *EventBridge User Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-eventbus-logconfig.html#cfn-events-eventbus-logconfig-includedetail
+            '''
+            result = self._values.get("include_detail")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def level(self) -> typing.Optional[builtins.str]:
+            '''The level of logging detail to include. This applies to all log destinations for the event bus.
+
+            For more information, see `Specifying event bus log level <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html#eb-event-bus-logs-level>`_ in the *EventBridge User Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-eventbus-logconfig.html#cfn-events-eventbus-logconfig-level
+            '''
+            result = self._values.get("level")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "LogConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
 
 @jsii.implements(_IInspectable_c2943556)
 class CfnEventBusPolicy(
@@ -4760,6 +4863,7 @@ class CfnEventBusPolicyProps:
         "description": "description",
         "event_source_name": "eventSourceName",
         "kms_key_identifier": "kmsKeyIdentifier",
+        "log_config": "logConfig",
         "policy": "policy",
         "tags": "tags",
     },
@@ -4773,6 +4877,7 @@ class CfnEventBusProps:
         description: typing.Optional[builtins.str] = None,
         event_source_name: typing.Optional[builtins.str] = None,
         kms_key_identifier: typing.Optional[builtins.str] = None,
+        log_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventBus.LogConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         policy: typing.Any = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -4783,6 +4888,7 @@ class CfnEventBusProps:
         :param description: The event bus description.
         :param event_source_name: If you are creating a partner event bus, this specifies the partner event source that the new event bus will be matched with.
         :param kms_key_identifier: The identifier of the AWS KMS customer managed key for EventBridge to use, if you choose to use a customer managed key to encrypt events on this event bus. The identifier can be the key Amazon Resource Name (ARN), KeyId, key alias, or key alias ARN. If you do not specify a customer managed key identifier, EventBridge uses an AWS owned key to encrypt events on the event bus. For more information, see `Identify and view keys <https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html>`_ in the *AWS Key Management Service Developer Guide* . .. epigraph:: Schema discovery is not supported for event buses encrypted using a customer managed key. EventBridge returns an error if: - You call ``[CreateDiscoverer](https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers.html#CreateDiscoverer)`` on an event bus set to use a customer managed key for encryption. - You call ``[UpdatedEventBus](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdatedEventBus.html)`` to set a customer managed key on an event bus with schema discovery enabled. To enable schema discovery on an event bus, choose to use an AWS owned key . For more information, see `Encrypting events <https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-encryption-event-bus-cmkey.html>`_ in the *Amazon EventBridge User Guide* . > If you have specified that EventBridge use a customer managed key for encrypting the source event bus, we strongly recommend you also specify a customer managed key for any archives for the event bus as well. For more information, see `Encrypting archives <https://docs.aws.amazon.com/eventbridge/latest/userguide/encryption-archives.html>`_ in the *Amazon EventBridge User Guide* .
+        :param log_config: The logging configuration settings for the event bus. For more information, see `Configuring logs for event buses <https://docs.aws.amazon.com/eb-event-bus-logs.html>`_ in the *EventBridge User Guide* .
         :param policy: The permissions policy of the event bus, describing which other AWS accounts can write events to this event bus.
         :param tags: Tags to associate with the event bus.
 
@@ -4807,6 +4913,10 @@ class CfnEventBusProps:
                 description="description",
                 event_source_name="eventSourceName",
                 kms_key_identifier="kmsKeyIdentifier",
+                log_config=events.CfnEventBus.LogConfigProperty(
+                    include_detail="includeDetail",
+                    level="level"
+                ),
                 policy=policy,
                 tags=[CfnTag(
                     key="key",
@@ -4821,6 +4931,7 @@ class CfnEventBusProps:
             check_type(argname="argument description", value=description, expected_type=type_hints["description"])
             check_type(argname="argument event_source_name", value=event_source_name, expected_type=type_hints["event_source_name"])
             check_type(argname="argument kms_key_identifier", value=kms_key_identifier, expected_type=type_hints["kms_key_identifier"])
+            check_type(argname="argument log_config", value=log_config, expected_type=type_hints["log_config"])
             check_type(argname="argument policy", value=policy, expected_type=type_hints["policy"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -4834,6 +4945,8 @@ class CfnEventBusProps:
             self._values["event_source_name"] = event_source_name
         if kms_key_identifier is not None:
             self._values["kms_key_identifier"] = kms_key_identifier
+        if log_config is not None:
+            self._values["log_config"] = log_config
         if policy is not None:
             self._values["policy"] = policy
         if tags is not None:
@@ -4909,6 +5022,19 @@ class CfnEventBusProps:
         result = self._values.get("kms_key_identifier")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def log_config(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventBus.LogConfigProperty]]:
+        '''The logging configuration settings for the event bus.
+
+        For more information, see `Configuring logs for event buses <https://docs.aws.amazon.com/eb-event-bus-logs.html>`_ in the *EventBridge User Guide* .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.html#cfn-events-eventbus-logconfig
+        '''
+        result = self._values.get("log_config")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventBus.LogConfigProperty]], result)
+
     @builtins.property
     def policy(self) -> typing.Any:
         '''The permissions policy of the event bus, describing which other AWS accounts can write events to this event bus.
@@ -12941,6 +13067,7 @@ def _typecheckingstub__5766595a149723459145d9f55c6afa7ed3017d49f4af7cec85e0fffe2
     description: typing.Optional[builtins.str] = None,
     event_source_name: typing.Optional[builtins.str] = None,
     kms_key_identifier: typing.Optional[builtins.str] = None,
+    log_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventBus.LogConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     policy: typing.Any = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -12989,6 +13116,12 @@ def _typecheckingstub__1899d0d8378d7d8ade574708aa2d0221794e2fcd5f946287a6f238e59
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__51db51bf8f1ebc8d9c19cdf02644ddeaaef6bd2b5c86607383cd85b5fa2030c1(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventBus.LogConfigProperty]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__6069dbf8a749c1a9a0cd15c07c6efbd2f70dbd4c7e3a6e98efd29bdb8c7acb24(
     value: typing.Any,
 ) -> None:
@@ -13008,6 +13141,14 @@ def _typecheckingstub__19cc778177531cf61ae62a46e1a008d0fb9f91cd857dc37c522f0cd73
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__325c97a9fc2ec199dfb4fb51645bc16dde3cf1f257d1bcf5c86f7cd3a0b2d77c(
+    *,
+    include_detail: typing.Optional[builtins.str] = None,
+    level: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__c6df7e81a60de40e0e425694b7757e614a634ac89c7c10147ca4c807819a6b71(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,
@@ -13098,6 +13239,7 @@ def _typecheckingstub__79e3f734387b70ada8040490433e9e9ec9b92701ddfb55826c4adc111
     description: typing.Optional[builtins.str] = None,
     event_source_name: typing.Optional[builtins.str] = None,
     kms_key_identifier: typing.Optional[builtins.str] = None,
+    log_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventBus.LogConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     policy: typing.Any = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:

aws_cdk/aws_gamelift/__init__.py

@@ -1976,7 +1976,7 @@ class CfnContainerFleet(
 
             The location value might refer to a fleet's remote location or its home Region.
 
-            :param desired_ec2_instances: The number of EC2 instances you want to maintain in the specified fleet location. This value must fall between the minimum and maximum size limits.
+            :param desired_ec2_instances: The number of EC2 instances you want to maintain in the specified fleet location. This value must fall between the minimum and maximum size limits. If any auto-scaling policy is defined for the container fleet, the desired instance will only be applied once during fleet creation and will be ignored in updates to avoid conflicts with auto-scaling. During updates with any auto-scaling policy defined, if current desired instance is lower than the new MinSize, it will be increased to the new MinSize; if current desired instance is larger than the new MaxSize, it will be decreased to the new MaxSize.
             :param max_size: The maximum value that is allowed for the fleet's instance count for a location.
             :param min_size: The minimum value allowed for the fleet's instance count for a location.
 
@@ -2010,7 +2010,7 @@ class CfnContainerFleet(
         def desired_ec2_instances(self) -> jsii.Number:
             '''The number of EC2 instances you want to maintain in the specified fleet location.
 
-            This value must fall between the minimum and maximum size limits.
+            This value must fall between the minimum and maximum size limits. If any auto-scaling policy is defined for the container fleet, the desired instance will only be applied once during fleet creation and will be ignored in updates to avoid conflicts with auto-scaling. During updates with any auto-scaling policy defined, if current desired instance is lower than the new MinSize, it will be increased to the new MinSize; if current desired instance is larger than the new MaxSize, it will be decreased to the new MaxSize.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-gamelift-containerfleet-locationcapacity.html#cfn-gamelift-containerfleet-locationcapacity-desiredec2instances
             '''

aws_cdk/aws_guardduty/__init__.py

@@ -1968,6 +1968,7 @@ class CfnIPSet(
             # the properties below are optional
             activate=False,
             detector_id="detectorId",
+            expected_bucket_owner="expectedBucketOwner",
             name="name",
             tags=[CfnTag(
                 key="key",
@@ -1985,6 +1986,7 @@ class CfnIPSet(
         location: builtins.str,
         activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         detector_id: typing.Optional[builtins.str] = None,
+        expected_bucket_owner: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -1995,6 +1997,7 @@ class CfnIPSet(
         :param location: The URI of the file that contains the IPSet.
         :param activate: Indicates whether or not GuardDuty uses the ``IPSet`` .
         :param detector_id: The unique ID of the detector of the GuardDuty account for which you want to create an IPSet. To find the ``detectorId`` in the current Region, see the Settings page in the GuardDuty console, or run the `ListDetectors <https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html>`_ API.
+        :param expected_bucket_owner: The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field. When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
         :param name: The user-friendly name to identify the IPSet. Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_).
         :param tags: The tags to be added to a new IP set resource. Each tag consists of a key and an optional value, both of which you define. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
         '''
@@ -2007,6 +2010,7 @@ class CfnIPSet(
             location=location,
             activate=activate,
             detector_id=detector_id,
+            expected_bucket_owner=expected_bucket_owner,
             name=name,
             tags=tags,
         )
@@ -2119,6 +2123,19 @@ class CfnIPSet(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "detectorId", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="expectedBucketOwner")
+    def expected_bucket_owner(self) -> typing.Optional[builtins.str]:
+        '''The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "expectedBucketOwner"))
+
+    @expected_bucket_owner.setter
+    def expected_bucket_owner(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9191409994fec537ce4d4e8e40256113b2937c7a1bb90b2f14b71998143f9810)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "expectedBucketOwner", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> typing.Optional[builtins.str]:
@@ -2154,6 +2171,7 @@ class CfnIPSet(
         "location": "location",
         "activate": "activate",
         "detector_id": "detectorId",
+        "expected_bucket_owner": "expectedBucketOwner",
         "name": "name",
         "tags": "tags",
     },
@@ -2166,6 +2184,7 @@ class CfnIPSetProps:
         location: builtins.str,
         activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         detector_id: typing.Optional[builtins.str] = None,
+        expected_bucket_owner: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -2175,6 +2194,7 @@ class CfnIPSetProps:
         :param location: The URI of the file that contains the IPSet.
         :param activate: Indicates whether or not GuardDuty uses the ``IPSet`` .
         :param detector_id: The unique ID of the detector of the GuardDuty account for which you want to create an IPSet. To find the ``detectorId`` in the current Region, see the Settings page in the GuardDuty console, or run the `ListDetectors <https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html>`_ API.
+        :param expected_bucket_owner: The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field. When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
         :param name: The user-friendly name to identify the IPSet. Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_).
         :param tags: The tags to be added to a new IP set resource. Each tag consists of a key and an optional value, both of which you define. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
 
@@ -2194,6 +2214,7 @@ class CfnIPSetProps:
                 # the properties below are optional
                 activate=False,
                 detector_id="detectorId",
+                expected_bucket_owner="expectedBucketOwner",
                 name="name",
                 tags=[CfnTag(
                     key="key",
@@ -2207,6 +2228,7 @@ class CfnIPSetProps:
             check_type(argname="argument location", value=location, expected_type=type_hints["location"])
             check_type(argname="argument activate", value=activate, expected_type=type_hints["activate"])
             check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
+            check_type(argname="argument expected_bucket_owner", value=expected_bucket_owner, expected_type=type_hints["expected_bucket_owner"])
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -2217,6 +2239,8 @@ class CfnIPSetProps:
             self._values["activate"] = activate
         if detector_id is not None:
             self._values["detector_id"] = detector_id
+        if expected_bucket_owner is not None:
+            self._values["expected_bucket_owner"] = expected_bucket_owner
         if name is not None:
             self._values["name"] = name
         if tags is not None:
@@ -2265,6 +2289,17 @@ class CfnIPSetProps:
         result = self._values.get("detector_id")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def expected_bucket_owner(self) -> typing.Optional[builtins.str]:
+        '''The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.
+
+        When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-guardduty-ipset.html#cfn-guardduty-ipset-expectedbucketowner
+        '''
+        result = self._values.get("expected_bucket_owner")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def name(self) -> typing.Optional[builtins.str]:
         '''The user-friendly name to identify the IPSet.
@@ -4096,6 +4131,7 @@ class CfnThreatIntelSet(
             # the properties below are optional
             activate=False,
             detector_id="detectorId",
+            expected_bucket_owner="expectedBucketOwner",
             name="name",
             tags=[CfnTag(
                 key="key",
@@ -4113,6 +4149,7 @@ class CfnThreatIntelSet(
         location: builtins.str,
         activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         detector_id: typing.Optional[builtins.str] = None,
+        expected_bucket_owner: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -4123,6 +4160,7 @@ class CfnThreatIntelSet(
         :param location: The URI of the file that contains the ThreatIntelSet.
         :param activate: A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
         :param detector_id: The unique ID of the detector of the GuardDuty account for which you want to create a ``ThreatIntelSet`` . To find the ``detectorId`` in the current Region, see the Settings page in the GuardDuty console, or run the `ListDetectors <https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html>`_ API.
+        :param expected_bucket_owner: The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field. When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
         :param name: A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
         :param tags: The tags to be added to a new threat list resource. Each tag consists of a key and an optional value, both of which you define. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
         '''
@@ -4135,6 +4173,7 @@ class CfnThreatIntelSet(
             location=location,
             activate=activate,
             detector_id=detector_id,
+            expected_bucket_owner=expected_bucket_owner,
             name=name,
             tags=tags,
         )
@@ -4248,6 +4287,19 @@ class CfnThreatIntelSet(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "detectorId", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="expectedBucketOwner")
+    def expected_bucket_owner(self) -> typing.Optional[builtins.str]:
+        '''The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "expectedBucketOwner"))
+
+    @expected_bucket_owner.setter
+    def expected_bucket_owner(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__45c0733c6c75c09ff089a9606f91e845cf362445012b247e68e83208c0a5aaee)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "expectedBucketOwner", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> typing.Optional[builtins.str]:
@@ -4283,6 +4335,7 @@ class CfnThreatIntelSet(
         "location": "location",
         "activate": "activate",
         "detector_id": "detectorId",
+        "expected_bucket_owner": "expectedBucketOwner",
         "name": "name",
         "tags": "tags",
     },
@@ -4295,6 +4348,7 @@ class CfnThreatIntelSetProps:
         location: builtins.str,
         activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         detector_id: typing.Optional[builtins.str] = None,
+        expected_bucket_owner: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
@@ -4304,6 +4358,7 @@ class CfnThreatIntelSetProps:
         :param location: The URI of the file that contains the ThreatIntelSet.
         :param activate: A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
         :param detector_id: The unique ID of the detector of the GuardDuty account for which you want to create a ``ThreatIntelSet`` . To find the ``detectorId`` in the current Region, see the Settings page in the GuardDuty console, or run the `ListDetectors <https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html>`_ API.
+        :param expected_bucket_owner: The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field. When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
         :param name: A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
         :param tags: The tags to be added to a new threat list resource. Each tag consists of a key and an optional value, both of which you define. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
 
@@ -4323,6 +4378,7 @@ class CfnThreatIntelSetProps:
                 # the properties below are optional
                 activate=False,
                 detector_id="detectorId",
+                expected_bucket_owner="expectedBucketOwner",
                 name="name",
                 tags=[CfnTag(
                     key="key",
@@ -4336,6 +4392,7 @@ class CfnThreatIntelSetProps:
             check_type(argname="argument location", value=location, expected_type=type_hints["location"])
             check_type(argname="argument activate", value=activate, expected_type=type_hints["activate"])
             check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
+            check_type(argname="argument expected_bucket_owner", value=expected_bucket_owner, expected_type=type_hints["expected_bucket_owner"])
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -4346,6 +4403,8 @@ class CfnThreatIntelSetProps:
             self._values["activate"] = activate
         if detector_id is not None:
             self._values["detector_id"] = detector_id
+        if expected_bucket_owner is not None:
+            self._values["expected_bucket_owner"] = expected_bucket_owner
         if name is not None:
             self._values["name"] = name
         if tags is not None:
@@ -4394,6 +4453,17 @@ class CfnThreatIntelSetProps:
         result = self._values.get("detector_id")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def expected_bucket_owner(self) -> typing.Optional[builtins.str]:
+        '''The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.
+
+        When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-guardduty-threatintelset.html#cfn-guardduty-threatintelset-expectedbucketowner
+        '''
+        result = self._values.get("expected_bucket_owner")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def name(self) -> typing.Optional[builtins.str]:
         '''A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
@@ -4700,6 +4770,7 @@ def _typecheckingstub__b0c6fd2cb08b5267e6265af6fae1a30df065b4b25dc1d6d684eec9f9b
     location: builtins.str,
     activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     detector_id: typing.Optional[builtins.str] = None,
+    expected_bucket_owner: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -4742,6 +4813,12 @@ def _typecheckingstub__1aa4bf6ad59c1223085a10fc5ece87e88253a83036d5b0e3947792ffc
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__9191409994fec537ce4d4e8e40256113b2937c7a1bb90b2f14b71998143f9810(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__0128f966eac1a136f141aedcb397b96308a170e31f1d45176a39160ebf5a7a8f(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -4760,6 +4837,7 @@ def _typecheckingstub__f47aa340c89b95bf1878c9cb7463920b568c23940ad283e6f2c2bb481
     location: builtins.str,
     activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     detector_id: typing.Optional[builtins.str] = None,
+    expected_bucket_owner: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -5075,6 +5153,7 @@ def _typecheckingstub__e60035c0bc955afb794ee89f0439deae280bfec665014cbbd161f0856
     location: builtins.str,
     activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     detector_id: typing.Optional[builtins.str] = None,
+    expected_bucket_owner: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -5117,6 +5196,12 @@ def _typecheckingstub__6198953302f0959c3d25abb6f0063fb638c6abf44a125235eafb49370
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__45c0733c6c75c09ff089a9606f91e845cf362445012b247e68e83208c0a5aaee(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__78860e52ab0e0d6681a85585054b7ed92f84696ec2b6a43bb90c609188bf36e6(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -5135,6 +5220,7 @@ def _typecheckingstub__0a5d0bedab8c4fad4ab288ce5a467dbe6a4d07ef2947521b14162f1e7
     location: builtins.str,
     activate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     detector_id: typing.Optional[builtins.str] = None,
+    expected_bucket_owner: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None: